UnitedHealth CEO Andrew Witty testifies before the Senate Finance Committee on Capitol Hill on May 1, 2024 in Washington, DC. In February hackers stole health and personal data of what UnitedHealth says is “potentially a substantial proportion” of patient information from its systems.
Witty said he was “disappointed and frustrated” by the flaw, as well, explaining that UnitedHealth was in the process of upgrading security and systems after acquiring Change Healthcare in October 2022. While the CEO said the company’s massive size and scope has enabled a speedy response to the incident, Wyden promised further investigation both of the cyberattack and broader questions surrounding the company.
The cyberattack has been a blow to the nation’s health care system because UnitedHealth Group — to contain the threat — had to shut down Change Healthcare systems used widely to process payment claims for U.S. health care providers. Those systems are now getting back to normal, Witty said, but senators grilled the CEO for not yet being able to specify how many and which patients have had their data compromised.
“To all those impacted, let me be clear: I’m deeply, deeply sorry…,” Witty said. “We will not rest — I will not rest — until we fix this.” “We’ve just heard excuse after excuse from Mr. Witty,” Wyden said. “The fact is, that first server that was hacked did not have multifactor authentication and Mr. Witty’s head of cybersecurity knew about it.”